Trust Assessment
evm-wallet-integration received a trust score of 95/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 0 medium, and 2 low severity. Key findings include Unpinned Dependencies in Skill Documentation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| LOW | Unpinned Dependencies in Skill Documentation The skill's dependency lists, provided as examples for developers, use caret (`^`) version ranges. This allows for automatic updates to minor and patch versions of packages. While common, this practice can introduce supply chain risks if a new version of a dependency contains a vulnerability or breaking change without explicit review. For production-grade applications, pinning dependencies to exact versions or using tilde (`~`) for patch-only updates is generally recommended to ensure deterministic builds and reduce the attack surface. Advise developers to pin all dependencies to exact versions (e.g., `1.0.0` instead of `^1.0.0`) or use tilde (`~`) for patch-only updates (e.g., `~1.0.0`) in their `package.json` files. This ensures deterministic builds and prevents unexpected changes from upstream packages. Regularly audit and update dependencies. | LLM | SKILL.md:204 | |
| LOW | Unpinned Dependencies in Skill Documentation The skill's dependency lists, provided as examples for developers, use caret (`^`) version ranges. This allows for automatic updates to minor and patch versions of packages. While common, this practice can introduce supply chain risks if a new version of a dependency contains a vulnerability or breaking change without explicit review. For production-grade applications, pinning dependencies to exact versions or using tilde (`~`) for patch-only updates is generally recommended to ensure deterministic builds and reduce the attack surface. Advise developers to pin all dependencies to exact versions (e.g., `1.0.0` instead of `^1.0.0`) or use tilde (`~`) for patch-only updates (e.g., `~1.0.0`) in their `package.json` files. This ensures deterministic builds and prevents unexpected changes from upstream packages. Regularly audit and update dependencies. | LLM | SKILL.md:216 |
Scan History
Embed Code
[](https://skillshield.io/report/03dc38d102fd3016)
Powered by SkillShield